The import looked up the key in all teams and stopped with "already exists
on another team", which also told the user that another team has the key.
Keys are unique per team, so reuse a key of the target team or create one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Login, registration and OAuth set a currentTeam attribute on the user model
that is not a database column, so a save of the user in the same request
would fail. Keep the team in the session and read it with currentTeam().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Fixes the denial of service advisory GHSA-8rr7-cvq3-gmfh (affected
versions >=1.5.0,<2.10.0). nette/schema moves to 1.3.6 with it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
SSH_COMMAND_TIMEOUT=0 (or an invalid value) removed the time limit of every
remote command, and imports could then be marked stale while still running.
Use the default of 3600 seconds for values that are not positive.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
resend-php 1.x reads the statusCode of Resend errors and knows more error
names. Coolify only uses emails->send and the exception classes, which did
not change.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The duplicate check used the signed-in user's current team, or all teams
when there was none. Check the team the key belongs to.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
GitHub, Gitea and Bitbucket manual webhooks accepted any signature when
APP_ENV=local. GitLab and the GitHub App webhook already did not.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 200 response with an empty body or an error page replaced the local
templates and the shared cache, so the service list became empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
resend-php 0.18 reads a "code" key that the Resend API does not send
(it sends statusCode), so every Resend error failed with Undefined array
key "code". Errors with names that the SDK does not know were returned as
a normal response and counted as a sent email. Read statusCode and name from
the error, and treat a response without an email id as an error.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a Lima backend to scripts/dev. Auto mode picks it on macOS when
limactl (Lima >= 2.0) is installed, and COOLIFY_DEV_SERVER_BACKEND=lima
forces it. Lima VMs are named coolify-dev-<slot>-<profile>. Coolify
connects to them through Lima's forwarded SSH port on
host.docker.internal, and only guest ports 80/443 are forwarded to
the host.
dev:qemu:seed now takes --ip and --port options, so the seeded server
can use a forwarded SSH address instead of the profile IP.
Add tests for the Lima start flow and for seeding with an overridden
address, and document the macOS setup in AGENTS.md.
- Configuration diff: report all settings when an app has no earlier
snapshot, so older apps show "configuration changed" again (#11430).
- DigitalOcean/Vultr: do not repeat the "API error:" prefix.
- HasSecretManager: the deleting listener returns nothing, so later
deleting listeners still run.
- GitLab webhook: use new_public_id() like the other webhooks.
- Team danger zone: show the link and open the page only for the team owner.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Security:
- Settings email: authorize the SMTP and Resend toggles.
- Server navbar: show Sentinel status only to users who can view Sentinel.
- GitHub source: permission gates on Sync name and Delete.
Broken features:
- Profile: avatar upload (missing import and file uploads trait).
- API tokens: keep the "Never" expiry choice.
- Environment variables: show validation errors instead of a generic error.
- Servers API: read the server uuid from the route in domains_by_server,
so ?uuid=<application> filters instead of returning 404.
- Cloud servers: Power On for stopped Hetzner, DigitalOcean and Vultr servers.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Let instant_remote_process throw on failed SSH/docker commands so the
real error (e.g. a missing coolify-sentinel container or an unreadable
SSH key) is reported. A null result, such as a literal "null" body, is
turned into an empty string, which guard() rejects as an invalid response.
Run curl with -sS so progress output stays out of the output while
errors are still reported.
Add tests for a failed docker exec and a literal null body.
The redesign removed the only way to call testConnection on GitHub sources;
GitLab sources still have the button.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Revert the app code changes of d666a0a95, 69eeb2f62, 1e66c9f9b and
a32082b03, so login, registration, OAuth, team danger zone, service
templates, and the other touched files are back to their earlier state.
Keep the removal of unused components and markup-only tests (d666a0a95
also contained those deletions by mistake).
StartupExecutionCleanupTest now fakes the template CDN with the current
file content, so app:init in the test no longer empties
templates/service-templates-latest.json.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Delete Blade components, component classes, Livewire components and
views that nothing uses after the redesign.
- Delete tests that only compare Blade/CSS source text; keep the source
checks for authorization gates, stable wire:key values and escaping.
- Update stale tests to the current UI and behaviour.
- Update DESIGN.md to the current navigation and layout.
- Add a lesson: test behaviour, not source markup.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- TrustHosts: validate the Host header also when the FQDN cache is cold.
- Settings email: authorize the SMTP and Resend toggles.
- Server navbar: show Sentinel status only to users who can view Sentinel.
- GitHub source: restore permission gates on Sync name and Delete, and the
Test connection button.
- Profile: make avatar upload work (missing import and file uploads trait).
- API tokens: keep the "Never" expiry choice.
- Environment variables: show validation errors instead of a generic error.
- Servers API: read the server uuid from the route in domains_by_server.
- Configuration diff: report all settings when no earlier snapshot exists.
- Cloud servers: restore Power On for stopped servers; do not repeat the
provider error prefix.
- HasSecretManager: do not stop later deleting listeners.
- GitLab webhook: use new_public_id() like the other webhooks.
- Dev: show the Lima VM start command on the localhost server page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A 200 response with an empty body or an error page replaced the local
templates and the shared cache, so the service list became empty.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Login, registration and OAuth set a fake currentTeam attribute on the user.
When refreshSession() saved the user in the same request, the query wrote
a currentTeam column that does not exist. Keep the team only in the session
and read it through currentTeam().
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Legacy Compose applications keep the old name of an external volume. The
deployment log now tells the user why and how to move to the external
volume. The storage page shows external volumes as a read-only list.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
An hourly command releases managed DNS records whose references all point
to missing or deleted resources, or that have no references after a grace
period. Each record goes through the per-hostname lock and re-check, so a
hostname that a user adds back is kept. An empty reference list no longer
deletes all references of a record.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Editing a domain (UI application, service and preview domains, the
General form, API application, preview, service, and service
application updates) now releases the hostnames that the edit
removed, like removing a domain does. Records that another live
resource still uses are kept.
- A per-hostname lock (managed-dns:{team}:{hostname}) now covers the
release (re-check, Cloudflare delete, row delete) and the create
paths. A release can no longer delete a record that is being added
again; a busy lock makes the release retry and the create wait or
retry, and a create after a release makes the record again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Switching an external volume from the old <uuid>_<name> volume to the
declared external volume on redeploy could make an app look as if it
lost its data (for example a database that initializes a new, empty
data directory).
- If a resource already has the storage entry with the old generated
name, the parsers keep using that volume and show a warning in the
deployment log and the service start log, with the steps to switch.
- Without that entry (new resources, or external volumes added later)
the external volume is used as declared.
- Deleting the old storage entry (storage page) switches to the
external volume on the next deployment; the storage entry shows a
note about it.
- Legacy Compose applications (parser versions 1 and 2) never stored
their volumes, so they keep the old volume names.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Compose volumes declared with external: true (or external: {name: x})
were renamed to <uuid>_<name>, so containers got a new empty volume
instead of the existing one. All Compose parsers (applications,
previews, services, and the legacy parsers) now use them as written:
no uuid prefix, no preview suffix, the top-level declaration kept, and
no tracking row, so Coolify never removes a shared external volume.
External volume names must be literal; ${VAR} names are rejected.
Existing <uuid>_<name> volumes and their rows are kept on redeploy.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
